Microsoft’s September Patch Tuesday Update Fixes Two Zero-Days

One week ago today, Microsoft released its September Patch Tuesday update. The company’s Patch Tuesday occurs on the second Tuesday of each month, and serves as a blanket update for all the security and stability patches Microsoft has worked on over the past 30 days.

For September’s update, Microsoft patched 81 flaws. And while it’s important to fix any security flaw that is discovered, two of these 81 flaws are particularly important to fix right away, as they are zero-day vulnerabilities.

A zero-day vulnerability is a security flaw that is publicly disclosed or exploited before the company has a chance to fix the issue. That makes zero-days more dangerous than your average security flaw: If a zero-day is publicly-disclosed, it increases the odds a bad actors will figure out how to exploit it. If it’s exploited, the risk that the known exploit could spread increases.

In this case, two of the zero-days patched in the September Patch Tuesday were publicly disclosed, not yet actively exploited. That includes CVE-2025-55234, an elevation of privilege vulnerability in Windows SMB. According to Microsoft, “SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks.”

The second zero-day, CVE-2024-21907 is an improper handling of exceptional conditions flaw in Newtonsoft.json. Microsoft says “crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.”

In addition to these flaws, there are 79 others that have been fixed. They include elevation of privilege vulnerabilities, security feature bypass vulnerabilities, remote code execution vulnerabilities, information disclosure vulnerabilities, denial of service vulnerabilities, and spoofing vulnerabilities.

To protect your machine from any of these vulnerabilities, especially the two zero-day flaws, make sure to install the update as soon as possible.